chore(deps): bump @ai-sdk/anthropic from 0.0.56 to 4.0.15

[dependabot]

Bumps @ai-sdk/anthropic from 0.0.56 to 4.0.15.

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/openai@​4.0.15

Patch Changes

• 0063c2d: Add the client-executed OpenAI Responses API computer tool with batched actions and screenshot outputs.

@​ai-sdk/xai@​4.0.14

Patch Changes

• Updated dependencies [0b61267]
  • @​ai-sdk/openai-compatible@​3.0.11

@​ai-sdk/mistral@​4.0.12

Patch Changes

• ba433f7: Add non-streaming Voxtral text-to-speech generation with saved voice IDs and one-off reference audio.

@​ai-sdk/react@​3.0.230

Patch Changes

• ai@6.0.228

@​ai-sdk/react@​3.0.229

Patch Changes

• Updated dependencies [6ace546]
  • ai@6.0.227

@​ai-sdk/vue@​3.0.228

Patch Changes

• ai@6.0.228

@​ai-sdk/vue@​3.0.227

Patch Changes

• Updated dependencies [6ace546]
  • ai@6.0.227

@​ai-sdk/svelte@​3.0.214

Patch Changes

• ai@5.0.214

@​ai-sdk/gateway@​3.0.151

Patch Changes

• 5e624ac: Backport: chore(provider/gateway): update gateway model settings files

@​ai-sdk/google-vertex@​3.0.150

Patch Changes

... (truncated)

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.15

Patch Changes

• Updated dependencies [31c7be8]
  • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

• 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

  getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

  A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

  A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

  Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

• cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.

• Updated dependencies [4be62c1]

• Updated dependencies [7805e4a]

• Updated dependencies [cd12954]

  • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

• Updated dependencies [e193290]
  • @​ai-sdk/provider-utils@​5.0.8

4.0.12

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod

4.0.11

Patch Changes

• Updated dependencies [0f93c57]
  • @​ai-sdk/provider@​4.0.3
  • @​ai-sdk/provider-utils@​5.0.7

4.0.10

... (truncated)

Commits

• 6976682 Version Packages (#17196)
• cb68fa6 Version Packages (#17175)
• cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
• cc3ab3a Version Packages (#17172)
• 4be62c1 fix(provider-utils): route provider-response URLs through the download-URL gu...
• c2913fb Version Packages (#17092)
• 308a519 chore: enforce consistent imports from zod/v4 instead of zod (#17090)
• 405116e Version Packages (#16937)
• f0d9a6c Version Packages (#16898)
• 7718519 Version Packages (#16881)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/anthropic since your current version.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supercli	Ready	Preview, Comment	Jul 16, 2026 1:25pm
supercli-client	Ready	Preview, Comment	Jul 16, 2026 1:25pm
supercli-docs	Ready	Preview, Comment	Jul 16, 2026 1:25pm